<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-type" content="text/html; charset=iso-8859-1">
<title>Overview of Java EE Security - The Java EE 5 Tutorial</title>
<meta name="robots" content="index,follow">
<meta name="robots" content="index,follow">
<meta name="date" content="2008-10-01">
<link rel="stylesheet" type="text/css" href="css/default.css">
<link rel="stylesheet" type="text/css" href="css/ipg.css">
<link rel="stylesheet" type="text/css" href="css/j5eetutorial.css">
</head>

<body>

<table border="0" cellpadding="5" cellspacing="0" width="100%">
<tbody>
   <tr valign="top">
      <td><p class="toc level1"><a href="docinfo.html">Document Information</a></p>
<p class="toc level1 tocsp"><a href="gexaf.html">Preface</a></p>
<p class="toc level1 tocsp"><a href="gfirp.html">Part&nbsp;I&nbsp;Introduction</a></p>
<p class="toc level2"><a href="bnaaw.html">1.&nbsp;&nbsp;Overview</a></p>
<p class="toc level2"><a href="gfiud.html">2.&nbsp;&nbsp;Using the Tutorial Examples</a></p>
<p class="toc level1 tocsp"><a href="bnadp.html">Part&nbsp;II&nbsp;The Web Tier</a></p>
<p class="toc level2"><a href="bnadr.html">3.&nbsp;&nbsp;Getting Started with Web Applications</a></p>
<p class="toc level2"><a href="bnafd.html">4.&nbsp;&nbsp;Java Servlet Technology</a></p>
<p class="toc level2"><a href="bnagx.html">5.&nbsp;&nbsp;JavaServer Pages Technology</a></p>
<p class="toc level2"><a href="bnajo.html">6.&nbsp;&nbsp;JavaServer Pages Documents</a></p>
<p class="toc level2"><a href="bnakc.html">7.&nbsp;&nbsp;JavaServer Pages Standard Tag Library</a></p>
<p class="toc level2"><a href="bnalj.html">8.&nbsp;&nbsp;Custom Tags in JSP Pages</a></p>
<p class="toc level2"><a href="bnaon.html">9.&nbsp;&nbsp;Scripting in JSP Pages</a></p>
<p class="toc level2"><a href="bnaph.html">10.&nbsp;&nbsp;JavaServer Faces Technology</a></p>
<p class="toc level2"><a href="bnaqz.html">11.&nbsp;&nbsp;Using JavaServer Faces Technology in JSP Pages</a></p>
<p class="toc level2"><a href="bnatx.html">12.&nbsp;&nbsp;Developing with JavaServer Faces Technology</a></p>
<p class="toc level2"><a href="bnavg.html">13.&nbsp;&nbsp;Creating Custom UI Components</a></p>
<p class="toc level2"><a href="bnawo.html">14.&nbsp;&nbsp;Configuring JavaServer Faces Applications</a></p>
<p class="toc level2"><a href="bnaxu.html">15.&nbsp;&nbsp;Internationalizing and Localizing Web Applications</a></p>
<p class="toc level1 tocsp"><a href="bnayk.html">Part&nbsp;III&nbsp;Web Services</a></p>
<p class="toc level2"><a href="bnayl.html">16.&nbsp;&nbsp;Building Web Services with JAX-WS</a></p>
<p class="toc level2"><a href="bnazf.html">17.&nbsp;&nbsp;Binding between XML Schema and Java Classes</a></p>
<p class="toc level2"><a href="bnbdv.html">18.&nbsp;&nbsp;Streaming API for XML</a></p>
<p class="toc level2"><a href="bnbhf.html">19.&nbsp;&nbsp;SOAP with Attachments API for Java</a></p>
<p class="toc level1 tocsp"><a href="bnblr.html">Part&nbsp;IV&nbsp;Enterprise Beans</a></p>
<p class="toc level2"><a href="bnbls.html">20.&nbsp;&nbsp;Enterprise Beans</a></p>
<p class="toc level2"><a href="bnbnb.html">21.&nbsp;&nbsp;Getting Started with Enterprise Beans</a></p>
<p class="toc level2"><a href="bnboc.html">22.&nbsp;&nbsp;Session Bean Examples</a></p>
<p class="toc level2"><a href="bnbpk.html">23.&nbsp;&nbsp;A Message-Driven Bean Example</a></p>
<p class="toc level1 tocsp"><a href="bnbpy.html">Part&nbsp;V&nbsp;Persistence</a></p>
<p class="toc level2"><a href="bnbpz.html">24.&nbsp;&nbsp;Introduction to the Java Persistence API</a></p>
<p class="toc level2"><a href="bnbrl.html">25.&nbsp;&nbsp;Persistence in the Web Tier</a></p>
<p class="toc level2"><a href="bnbrs.html">26.&nbsp;&nbsp;Persistence in the EJB Tier</a></p>
<p class="toc level2"><a href="bnbtg.html">27.&nbsp;&nbsp;The Java Persistence Query Language</a></p>
<p class="toc level1 tocsp"><a href="bnbwi.html">Part&nbsp;VI&nbsp;Services</a></p>
<p class="toc level2"><a href="bnbwj.html">28.&nbsp;&nbsp;Introduction to Security in the Java EE Platform</a></p>
<div class="onpage">
<p class="toc level3"><a href="">Overview of Java EE Security</a></p>
<p class="toc level4"><a href="#bnbwl">A Simple Security Example</a></p>
<p class="toc level5"><a href="#bnbwm">Step 1: Initial Request</a></p>
<p class="toc level5"><a href="#bnbwo">Step 2: Initial Authentication</a></p>
<p class="toc level5"><a href="#bnbwq">Step 3: URL Authorization</a></p>
<p class="toc level5"><a href="#bnbws">Step 4: Fulfilling the Original Request</a></p>
<p class="toc level5"><a href="#bnbwu">Step 5: Invoking Enterprise Bean Business Methods</a></p>
<p class="toc level4 tocsp"><a href="#bnbww">Security Functions</a></p>
<p class="toc level4"><a href="#bnbwx">Characteristics of Application Security</a></p>
</div>
<p class="toc level3 tocsp"><a href="bnbwy.html">Security Implementation Mechanisms</a></p>
<p class="toc level4"><a href="bnbwy.html#bnbwz">Java SE Security Implementation Mechanisms</a></p>
<p class="toc level4"><a href="bnbwy.html#bnbxa">Java EE Security Implementation Mechanisms</a></p>
<p class="toc level5"><a href="bnbwy.html#bnbxb">Application-Layer Security</a></p>
<p class="toc level5"><a href="bnbwy.html#bnbxc">Transport-Layer Security</a></p>
<p class="toc level5"><a href="bnbwy.html#bnbxd">Message-Layer Security</a></p>
<p class="toc level3 tocsp"><a href="bnbxe.html">Securing Containers</a></p>
<p class="toc level4"><a href="bnbxe.html#bnbxf">Using Deployment Descriptors for Declarative Security</a></p>
<p class="toc level4"><a href="bnbxe.html#bnbxg">Using Annotations</a></p>
<p class="toc level4"><a href="bnbxe.html#bnbxh">Using Programmatic Security</a></p>
<p class="toc level3 tocsp"><a href="bnbxi.html">Securing the Application Server</a></p>
<p class="toc level3"><a href="bnbxj.html">Working with Realms, Users, Groups, and Roles</a></p>
<p class="toc level4"><a href="bnbxj.html#bnbxk">What Are Realms, Users, Groups, and Roles?</a></p>
<p class="toc level5"><a href="bnbxj.html#bnbxm">What Is a Realm?</a></p>
<p class="toc level5"><a href="bnbxj.html#bnbxn">What Is a User?</a></p>
<p class="toc level5"><a href="bnbxj.html#bnbxo">What Is a Group?</a></p>
<p class="toc level5"><a href="bnbxj.html#bnbxp">What Is a Role?</a></p>
<p class="toc level5"><a href="bnbxj.html#bnbxq">Some Other Terminology</a></p>
<p class="toc level4 tocsp"><a href="bnbxj.html#bnbxr">Managing Users and Groups on the Application Server</a></p>
<p class="toc level5"><a href="bnbxj.html#bnbxs">Adding Users to the Application Server</a></p>
<p class="toc level5"><a href="bnbxj.html#bnbxt">Adding Users to the Certificate Realm</a></p>
<p class="toc level4 tocsp"><a href="bnbxj.html#bnbxu">Setting Up Security Roles</a></p>
<p class="toc level4"><a href="bnbxj.html#bnbxv">Mapping Roles to Users and Groups</a></p>
<p class="toc level3 tocsp"><a href="bnbxw.html">Establishing a Secure Connection Using SSL</a></p>
<p class="toc level4"><a href="bnbxw.html#bnbxx">Installing and Configuring SSL Support</a></p>
<p class="toc level4"><a href="bnbxw.html#bnbxy">Specifying a Secure Connection in Your Application Deployment Descriptor</a></p>
<p class="toc level4"><a href="bnbxw.html#bnbxz">Verifying SSL Support</a></p>
<p class="toc level5"><a href="bnbxw.html#bnbya">Tips on Running SSL</a></p>
<p class="toc level4 tocsp"><a href="bnbxw.html#bnbyb">Working with Digital Certificates</a></p>
<p class="toc level5"><a href="bnbxw.html#bnbyc">Creating a Server Certificate</a></p>
<p class="toc level5"><a href="bnbxw.html#bnbyd">Signing Digital Certificates</a></p>
<p class="toc level5"><a href="bnbxw.html#bnbyf">Using a Different Server Certificate with the Application Server</a></p>
<p class="toc level5"><a href="bnbxw.html#bnbyg">Miscellaneous Commands for Certificates</a></p>
<p class="toc level4 tocsp"><a href="bnbxw.html#bnbyh">Enabling Mutual Authentication over SSL</a></p>
<p class="toc level5"><a href="bnbxw.html#bnbyi">Creating a Client Certificate for Mutual Authentication</a></p>
<p class="toc level3 tocsp"><a href="bnbyj.html">Further Information about Security</a></p>
<p class="toc level2 tocsp"><a href="bnbyk.html">29.&nbsp;&nbsp;Securing Java EE Applications</a></p>
<p class="toc level2"><a href="bncas.html">30.&nbsp;&nbsp;Securing Web Applications</a></p>
<p class="toc level2"><a href="bncdq.html">31.&nbsp;&nbsp;The Java Message Service API</a></p>
<p class="toc level2"><a href="bncgv.html">32.&nbsp;&nbsp;Java EE Examples Using the JMS API</a></p>
<p class="toc level2"><a href="bncih.html">33.&nbsp;&nbsp;Transactions</a></p>
<p class="toc level2"><a href="bncjh.html">34.&nbsp;&nbsp;Resource Connections</a></p>
<p class="toc level2"><a href="bncjx.html">35.&nbsp;&nbsp;Connector Architecture</a></p>
<p class="toc level1 tocsp"><a href="bnckn.html">Part&nbsp;VII&nbsp;Case Studies</a></p>
<p class="toc level2"><a href="bncko.html">36.&nbsp;&nbsp;The Coffee Break Application</a></p>
<p class="toc level2"><a href="bnclz.html">37.&nbsp;&nbsp;The Duke's Bank Application</a></p>
<p class="toc level1 tocsp"><a href="gexbq.html">Part&nbsp;VIII&nbsp;Appendixes</a></p>
<p class="toc level2"><a href="bncno.html">A.&nbsp;&nbsp;Java Encoding Schemes</a></p>
<p class="toc level2"><a href="bncnq.html">B.&nbsp;&nbsp;Preparation for Java EE Certification Exams</a></p>
<p class="toc level2"><a href="bncnt.html">C.&nbsp;&nbsp;About the Authors</a></p>
<p class="toc level1 tocsp"><a href="idx-1.html">Index</a></p>
</td>
      <td width="10px">&nbsp;</td>
      <td width="705px">
         <div class="header">
             <div class="header-links-top">
                 <a href="http://java.sun.com">java.sun.com</a> |
                 <a href="http://docs.sun.com/">docs.sun.com</a><br>
             </div> 
             <img src="graphics/tutorialBanner.gif" width="704" height="120" alt="The Java&trade; EE 5 Tutorial"/>
             <div class="header-links">
	         <a href="index.html">Home</a> |
                 <a href="http://java.sun.com/javaee/5/docs/tutorial/information/download.html">Download</a> |
                 <a href="http://java.sun.com/javaee/5/docs/tutorial/doc/JavaEETutorial.pdf">PDF</a> |
                 <a href="http://java.sun.com/javaee/5/docs/api/index.html">API</a> |
                 <a href="http://java.sun.com/javaee/5/docs/tutorial/information/faq.html">FAQ</a> |
                 <a href="http://java.sun.com/javaee/5/docs/tutorial/information/search.html">Search</a> |
                 <a href="http://java.sun.com/javaee/5/docs/tutorial/information/sendusmail.html">Feedback</a> |
                 <a href="http://java.sun.com/javaee/5/docs/tutorial/information/history.html">History</a>
             </div>
             <div class="navigation">
                 <a href="bnbwj.html"><img style="padding-right: 3px" src="graphics/leftButton.gif" border="0"></a>
                 <a href="sjsaseej2eet.html"><img style="padding-right: 3px" src="graphics/upButton.gif" border="0"></a>
                 <a href="bnbwy.html"><img style="padding-left: 3px" src="graphics/rightButton.gif" border="0"></a>
             </div>
         </div>

	 <div class="maincontent">      	 
             

<a name="bnbwk"></a><h3>Overview of Java EE Security</h3>
<a name="indexterm-2390"></a><a name="indexterm-2391"></a><p>Java EE, web, and web services applications are made up of components that
can be deployed into different containers. These components are used to build a
multitier enterprise application. Security for components is provided by their containers. A container
provides two kinds of security: declarative and programmatic security.</p>
<ul><li><p><a name="indexterm-2392"></a><a name="indexterm-2393"></a><a name="indexterm-2394"></a><b>Declarative security</b> expresses an application component&rsquo;s security requirements using <b>deployment descriptors</b>. Deployment descriptors are external to an application, and include information that specifies how security roles and access requirements are mapped into environment-specific security roles, users, and policies. For more information about deployment descriptors, read <a href="bnbxe.html#bnbxf">Using Deployment Descriptors for Declarative Security</a>.</p><p><b>Annotations</b> (also called <b>metadata</b>) are used to specify information about security within a class file. When the application is deployed, this information can either be used by or overridden by the application deployment descriptor. Annotations save your from having to write declarative information inside XML descriptors. Instead, you just put annotations on the code and the required information gets generated. For more information about annotations, read <a href="bnbxe.html#bnbxg">Using Annotations</a>.</p></li>
<li><p><a name="indexterm-2395"></a><a name="indexterm-2396"></a><b>Programmatic security</b> is embedded in an application and is used to make security decisions. Programmatic security is useful when declarative security alone is not sufficient to express the security model of an application. For more information about programmatic security, read <a href="bnbxe.html#bnbxh">Using Programmatic Security</a>.</p></li></ul>


<a name="bnbwl"></a><h4>A Simple Security Example</h4>
<a name="indexterm-2397"></a><a name="indexterm-2398"></a><p>The security behavior of a Java EE environment may be better understood by
examining what happens in a simple application with a web client, a
JSP user interface, and enterprise bean business logic.</p><p>In the following example, which is taken from JSR-244, the <a href="http://www.jcp.org/en/jsr/detail?id=244">Java EE 5 Specification </a>, the
web client relies on the web server to act as its authentication proxy
by collecting user authentication data from the client and using it to establish
an authenticated session.</p>

<a name="bnbwm"></a><h5>Step 1: Initial Request</h5>
<p>In the first step of this example, the web client requests the
main application URL. This action is shown in <a href="#bnbwn">Figure&nbsp;28-1</a>.</p><a name="bnbwn"></a><h6>Figure&nbsp;28-1 Initial Request</h6><img src="figures/security-J2EE.3-1.gif" alt="Diagram of initial request from web client to web server for access to a protected resource"></img><p>Since the client has not yet authenticated itself to the application environment, the
server responsible for delivering the web portion of the application (hereafter referred to
as <b>web server</b>) detects this and invokes the appropriate authentication mechanism for this resource. For
more information on these mechanisms, read <a href="bnbwy.html">Security Implementation Mechanisms</a>.</p>

<a name="bnbwo"></a><h5>Step 2: Initial Authentication</h5>
<p>The web server returns a form that the web client uses to
collect authentication data (for example, user name and password) from the user. The
web client forwards the authentication data to the web server, where it is
validated by the web server, as shown in <a href="#bnbwp">Figure&nbsp;28-2</a>.</p><a name="bnbwp"></a><h6>Figure&nbsp;28-2 Initial Authentication</h6><img src="figures/security-J2EE.3-2.gif" alt="Diagram of initial authentication: server sends form to client, which sends authentication data to server for validation"></img><p>The validation mechanism may be local to a server, or it may
leverage the underlying security services. On the basis of the validation, the web server
sets a credential for the user.</p>

<a name="bnbwq"></a><h5>Step 3: URL Authorization</h5>
<p>The credential is used for future determinations of whether the user is authorized
to access restricted resources it may request. The web server consults the security
policy (derived from the deployment descriptor) associated with the web resource to determine
the security roles that are permitted access to the resource. The web container
then tests the user&rsquo;s credential against each role to determine if it can
map the user to the role. <a href="#bnbwr">Figure&nbsp;28-3</a> shows this process.</p><a name="bnbwr"></a><h6>Figure&nbsp;28-3 URL Authorization</h6><img src="figures/security-J2EE.3-3.gif" alt="Diagram of URL authorization"></img><p>The web server&rsquo;s evaluation stops with an &ldquo;is authorized&rdquo; outcome when the web
server is able to map the user to a role. A &ldquo;not authorized&rdquo;
outcome is reached if the web server is unable to map the user
to any of the permitted roles.</p>

<a name="bnbws"></a><h5>Step 4: Fulfilling the Original Request</h5>
<p>If the user is authorized, the web server returns the result of
the original URL request, as shown in <a href="#bnbwt">Figure&nbsp;28-4</a>.</p><a name="bnbwt"></a><h6>Figure&nbsp;28-4 Fulfilling the Original Request</h6><img src="figures/security-J2EE.3-4.gif" alt="Diagram of request fulfillment, showing server returning result to client"></img><p>In our example, the response URL of a JSP page is returned,
enabling the user to post form data that needs to be handled by
the business logic component of the application. Read <a href="bncas.html">Chapter&nbsp;30, Securing Web Applications</a> for more information on
protecting web applications.</p>

<a name="bnbwu"></a><h5>Step 5: Invoking Enterprise Bean Business Methods</h5>
<p>The JSP page performs the remote method call to the enterprise bean, using
the user&rsquo;s credential to establish a secure association between the JSP page and
the enterprise bean (as shown in <a href="#bnbwv">Figure&nbsp;28-5</a>). The association is implemented as
two related security contexts, one in the web server and one in the
EJB container.</p><a name="bnbwv"></a><h6>Figure&nbsp;28-5 Invoking an Enterprise Bean Business Method</h6><img src="figures/security-J2EE.3-5.gif" alt="Diagram of authorization process between JSP/servlet object and enterprise bean"></img><p>The EJB container is responsible for enforcing access control on the enterprise bean
method. It consults the security policy (derived from the deployment descriptor) associated with
the enterprise bean to determine the security roles that are permitted access to
the method. For each role, the EJB container uses the security context associated
with the call to determine if it can map the caller to the
role.</p><p>The container&rsquo;s evaluation stops with an &ldquo;is authorized&rdquo; outcome when the container is
able to map the caller&rsquo;s credential to a role. A &ldquo;not authorized&rdquo; outcome
is reached if the container is unable to map the caller to any
of the permitted roles. A &ldquo;not authorized&rdquo; result causes an exception to be
thrown by the container, and propagated back to the calling JSP page.</p><p>If the call is authorized, the container dispatches control to the enterprise bean
method. The result of the bean&rsquo;s execution of the call is returned to
the JSP, and ultimately to the user by the web server and
the web client.</p><p>Read <a href="bnbyk.html">Chapter&nbsp;29, Securing Java EE Applications</a> for more information on protecting web applications.</p>

<a name="bnbww"></a><h4>Security Functions</h4>
<a name="indexterm-2399"></a><a name="indexterm-2400"></a><p>A properly implemented security mechanism will provide the following functionality:</p>
<ul><li><p>Prevent unauthorized access to application functions and business or personal data</p></li>
<li><p>Hold system users accountable for operations they perform (non-repudiation)</p></li>
<li><p>Protect a system from service interruptions and other breaches that affect quality of service</p></li></ul>
<p>Ideally, properly implemented security mechanisms will also provide the following functionality:</p>
<ul><li><p>Easy to administer</p></li>
<li><p>Transparent to system users</p></li>
<li><p>Interoperable across application and enterprise boundaries</p></li></ul>


<a name="bnbwx"></a><h4>Characteristics of Application Security</h4>
<a name="indexterm-2401"></a><a name="indexterm-2402"></a><a name="indexterm-2403"></a><a name="indexterm-2404"></a><p>Java EE applications consist of components that can contain both protected and unprotected
resources. Often, you need to protect resources to ensure that only authorized users
have access. <b>Authorization</b> provides controlled access to protected resources. Authorization is based on
identification and authentication. <b>Identification</b> is a process that enables recognition of an entity by
a system, and <b>authentication</b> is a process that verifies the identity of a
user, device, or other entity in a computer system, usually as a prerequisite
to allowing access to resources in a system.</p><p>Authorization and authentication are not required for an entity to access unprotected resources.
Accessing a resource without authentication is referred to as unauthenticated or anonymous access.</p><p>These and several other well-defined characteristics of application security that, when properly addressed,
help to minimize the security threats faced by an enterprise, include the following:</p>
<ul><li><p><b>Authentication</b>: The means by which communicating entities (for example, client and server) prove to one another that they are acting on behalf of specific identities that are authorized for access. This ensures that users are who they say they are.</p></li>
<li><p><a name="indexterm-2405"></a><b>Authorization</b>, or <b>Access Control</b>: The means by which interactions with resources are limited to collections of users or programs for the purpose of enforcing integrity, confidentiality, or availability constraints. This ensures that users have permission to perform operations or access data.</p></li>
<li><p><a name="indexterm-2406"></a><a name="indexterm-2407"></a><b>Data integrity</b>: The means used to prove that information has not been modified by a third party (some entity other than the source of the information). For example, a recipient of data sent over an open network must be able to detect and discard messages that were modified after they were sent. This ensures that only authorized users can modify data.</p></li>
<li><p><b>Confidentiality</b> or <b>Data Privacy</b>: The means used to ensure that information is made available only to users who are authorized to access it. This ensures that only authorized users can view sensitive data.</p></li>
<li><p><a name="indexterm-2408"></a><b>Non-repudiation</b>: The means used to prove that a user performed some action such that the user cannot reasonably deny having done so. This ensures that transactions can be proven to have happened.</p></li>
<li><p><a name="indexterm-2409"></a><b>Quality of Service (QoS)</b>: The means used to provide better service to selected network traffic over various technologies.</p></li>
<li><p><a name="indexterm-2410"></a><b>Auditing</b>: The means used to capture a tamper-resistant record of security-related events for the purpose of being able to evaluate the effectiveness of security policies and mechanisms. To enable this, the system maintains a record of transactions and security information.</p></li></ul>

         </div>
         <div class="navigation">
             <a href="bnbwj.html"><img style="padding-right: 3px" src="graphics/leftButton.gif" border="0"></a>
             <a href="sjsaseej2eet.html"><img style="padding-right: 3px" src="graphics/upButton.gif" border="0"></a>
             <a href="bnbwy.html"><img style="padding-left: 3px" src="graphics/rightButton.gif" border="0"></a>
         </div>

         <div class="copyright">
      	    <p>The material in The Java&trade; EE 5 Tutorial is <a href='docinfo.html'>copyright</a>-protected and may not be published in other works without express written permission from Sun Microsystems.</p>
      	 </div>

      </td>
   </tr>
</tbody>
</table>
</body>
</html>

